# Managing Credential Stores

> 1. Click **Add** on the **Credential Stores** page. The **Add New Credential Store** dialog appears.
2. From the **Type** drop-down, select which secure store is used. The available options depend upon which [plugins](https://docs.uipath.com/orchestrator/standalone/2022.10/installation-guide/uipath-orchestrator-dll-config#password-vault) have been enabled.
3. The next steps will vary based on the credential store you want to create. Your options are:

## Creating a Credential Store

1. Click **Add** on the **Credential Stores** page. The **Add New Credential Store** dialog appears.
2. From the **Type** drop-down, select which secure store is used. The available options depend upon which [plugins](https://docs.uipath.com/orchestrator/standalone/2022.10/installation-guide/uipath-orchestrator-dll-config#password-vault) have been enabled.
3. The next steps will vary based on the credential store you want to create. Your options are:

   * **Orchestrator Database**
   * **CyberArk**
   * **Azure Key Vault** – Choose between **Azure Key Vault** and **Azure Key Vault (read-only)**
   * **HashiCorp Vault** – Choose between **HashiCorp Vault** and **HashiCorp (read-only)**
   * **BeyondTrust** – Choose between **BeyondTrust Password Safe - Managed Accounts** and **BeyondTrust Password Safe - Team Passwords**

     :::note
     You can only have one Orchestrator Database store.
     :::

**Orchestrator Database**

1. Click **Create**, Orchestrator database stores do not have any configurable properties.

**CyberArk**

:::note
A CyberArk store configured in multiple tenants using the same App ID, Safe, and Folder Name, will permit access to stored credentials across tenants. To maintain tenant-level security and isolation, ensure different configurations are used for each tenant's CyberArk store.
:::

1. In the **Name** field, type a name for the new credential store.
2. In the **App ID** field, enter the application ID for your Orchestrator instance from the CyberArk® PVWA (Password Vault Web Access) interface. See [here](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/Common/Adding-Applications.htm?tocpath=Administration%7CApplication%20management%7C_____1) for details.
3. In the **CyberArk Safe** field, enter the safe name as defined in the CyberArk® PVWA. See [here](storing-credentials-in-cyberark.md) for details.
4. In the **CyberArk Folder** field, enter the location in which CyberArk® stores your credentials.
5. Click **Create**. Your new credential store is ready for use.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-227471-cf4d5e7c.webp)

**CyberArk CCP**

:::note
A CyberArk store configured in multiple tenants using the same App ID, Safe, and Folder Name, will permit access to stored credentials across tenants. To maintain tenant-level security and isolation, ensure different configurations are used for each tenant's CyberArk store.
:::

1. In the **Name** field, type a name for the new credential store.
2. In the **App ID** field, enter the application ID for your Orchestrator instance from the CyberArk® PVWA (Password Vault Web Access) interface. See [here](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/Common/Adding-Applications.htm?tocpath=Administration%7CApplication%20management%7C_____1) for details.
3. In the **CyberArk Safe** field, enter the safe name defined in the CyberArk® PVWA. See [here](cyberark-ccp-integration.md) for details.
4. In the **CyberArk Folder** field, enter the location in which CyberArk® stores your credentials.
5. In the **Central Credential Provider URL** field, enter the Central Credential Provider's address.
6. In the **Web Service Name** field, enter the name of the Central Credential Provider web service. If you leave this field empty, the default name is used: **AIMWebService**.
7. The **Client Certificate** needs to be configured when the the CyberArk Application uses the [client certificate authentication method](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/CP%20and%20ASCP/Application-Authentication-Methods-general.htm#ClientCert). The expected input is a `.pfx` file which stores the private and the public key of the certificate. The client certificate needs to be installed on the machine where CyberArk CCP AIMWebservice is deployed.

   :::note
   The client certificate is used by CyberArk credential provided to authenticate the application defined in Orchestrator credential store. See the official CyberArk documentation for details on [application authentication methods](https://docs.cyberark.com/credential-providers/latest/en/content/cp%20and%20ascp/application-authentication-methods-general.htm).

   The client certificate is a PKCS12 binary format file that stores the certificate chain public key(s) and the private key.

   If the client certificate is encoded in base 64 then run the following `certutil` command to decode it in binary format:

   `certutil -decode client_certificate_encoded.pfx client_certificate.pfx`
   :::
8. In the **Client Certificate Password** field, enter the password of the client certificate.
9. The **Server Root Certificate** needs to be configured when a self signed Root CA certificate is used by the CyberArk CCP AIMWebService for incoming HTTP requests. It is used in HTTPS TLS handshake certificate chain validation. The expected input is a `.crt` or `.cer` file which stores the root CA certificate public key.
10. Click **Create**. Your new credential store is ready for use.

    ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-225747-277004cb.webp)

**Azure Key Vault**

Key Vault credential stores use [RBAC](https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault#resources) type authentication. After you've created a service principal, perform these steps:

1. In the **Name** field, type a name for the new credential store.
2. In the **Key Vault Uri** field, enter the address of your Azure Key Vault. This is `https://<vault_name>.vault.azure.net/`.
3. In the **Directory ID** field, enter the directory ID found in the Azure portal.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-226775-c42a4162.webp)
4. In the **Client Id** field, enter the Application ID from your Azure AD App Registrations section where the Orchestrator app was registered.
5. In the **Client Secret** field, enter the secret needed to authenticate the client account entered in the previous step.
6. Click **Create**. Your new credential store is ready for use.

![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-226174-793a1e97.webp)

**HashiCorp Vault**

1. In the **Type** field, select **HashiCorp Vault** or **HashiCorp Vault (read-only)** as your credential store.
2. In the **Name** field, specify a name for the HashiCorp Vault credential store.
3. In the **Vault Uri** field, indicate the URI to the HTTP API of HashiCorp Vault.
4. In the **Authentication Type** field, indicate your preferred authentication method. Depending on the option you choose, yo must configure additional fields:
   * **AppRole** – **This is the recommended authentication method.** If you choose this option, make sure to also configure the following fields:
     * **Role Id** – Indicate the role ID to use with the AppRole authentication method
     * **Secret Id** – Enter the secret ID to use with the AppRole authentication type.
   * **UsernamePassword** – If you choose this option, make sure to also configure the following fields:
     * **Username** – Enter the username to use with UsernamePassword.
     * **Password** – Indicate the password to use with UsernamePassword authentication type.
   * **Ldap** – If you choose this option, make sure to also configure the following fields:
     * **Username** – Specify the username to use with the LDAP authentication type.
     * **Password** – Indicate the password to use with LDAP authentication type.
   * **Token** – If you choose this option, make sure to also configure the following field:
     * **Token** – Enter the token to use with the Token authentication type.
5. In the **Secrets Engine** field, indicate the secrets engine to use. Your options are:
   * **KeyValueV1**
   * **KeyValueV2**
   * **ActiveDirectory**
6. In the **Secrets Engine Mount Path** field, provide the [path of the secrets engine](https://www.vaultproject.io/docs/secrets#secrets-engines-lifecycle). If not supplied, it defaults to `kv` for **KeyValueV1**, `kv-v2` for **KeyValueV2** and `ad` for **ActiveDirectory**.
7. In the **Data Path** field, enter the path prefix to use for all stored secrets.
8. In the **Namespace** field, specify the [namespace](https://www.vaultproject.io/docs/enterprise/namespaces) to use. Only available in HashiCorp Vault Enterprise.
9. Click **Create**. Your new credential store is ready for use.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-233123-339935b0.webp)

**BeyondTrust**

1. In the **Type** field, select one of the following options:
   * **BeyondTrust Password Safe - Managed Accounts**
   * **BeyondTrust Password Safe - Team Passwords**
2. In the **Name** field, specify the name of the BeyondTrust credential store.
3. In the **BeyondTrust Host URL** field, specify the URL of your secret server instance.
4. In the **API Registration Key** field, indicate the value of the API registration key from BeyondTrust.
5. In the **API Run As Username** field, specify the BeyondTrust username under which you want to execute the calls.

**BeyondTrust Password Safe - Managed Accounts**

If you chose **BeyondTrust Password Safe - Managed Accounts**, continue with the following steps:

1. Optionally, in the **Default Managed System Name** field, indicate a fallback Managed System to be used in case no other Managed System has been provided in the Orchestrator Asset.
2. In the **System-Account Delimiter** field, specify the delimiter used to split the Managed System name from the Managed Account name in the Orchestrator Asset.
3. In the **Managed Account Type** field, indicate the BeyondTrust managed account type.
4. Click **Create**. Your new credential store is ready for use.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-231104-d44749a7.webp)

**BeyondTrust Password Safe - Team Passwords**

If you chose **BeyondTrust Password Safe - Team Passwords**, continue with the following steps:

1. Optionally, in the **Folder Path Prefix** field, indicate a default folder path prefix. This will be added in front of all Orchestrator Asset values.
2. In the **Folder / Account Delimiter** field, enter the delimiter used to split the Path from the Title in the Orchestrator Asset.
3. Click **Create**. Your new credential store is ready for use.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-231072-bd841af4.webp)

**Thycotic Secret Server**

1. In the **Type** field, select **Thycotic Secret Server**.
2. In the **Name** field, type a name for the new credential store.
3. In the **Secret Server URL** field, specify the URL of your secret server instance.
4. In the **Rule Name** field, provide the client onboarding rule name.
5. Optionally, in the **Rule Key** field, indicate the key from the onboarding rule. While this step is optional, we recommend specifying the **Rule Key** for improved security.
6. In the **Username Field** field, specify the slug name of the **Secret Template** field that Orchestrator will pull the username from when retrieving an asset from Thycotic Secret Server.
7. In the **Password Field** field, indicate the slug name of the **Secret Template** field that Orchestrator will pull the password from when retrieving an asset from Thycotic Secret Server.

   :::note
   You can find the slug name of the Secret Template field in **Admin &gt; Secret Templates &gt; Template &gt; Fields**.
   :::

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-227321-36f7f7f8.webp)

   When an asset or robot is created in Orchestrator, it is linked to a pre-existing secret using the External Name. In this case, that is the actual Secret ID from Thycotic Secret Server.

   You can find the Secret ID in the route. In the following example, it value is `5`.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-229515-26b96167.webp)

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-225989-dbb04200.webp)

## Editing a credential store

Navigate to **Stores** (Tenant &gt; **Credentials** &gt; **Stores**) and from the **More Actions** menu of the desired store, select **Edit**. The **Edit Credential Store** dialog appears is displayed.

:::note
The **Orchestrator Database** store does not have any editable properties.
:::

## Setting a default credential store

When using 2 or more credential stores, you have the ability to select which is the default store used for Robots and Assets. The same store may be used as the default for both, or you can select a different default store for each.

To select a default store, from the **More Actions** menu select **Set as robots default store** and/or **Set as assets default store**.

:::note
Changing the default store does not change an existing robot or asset configuration, it only controls what appears pre-selected in the **Credential Stores** drop-down when creating new robots or assets. Robots and assets always get their passwords from the store that was used when creating them. To change the credential store for a certain robot or asset, you must change it at the robot or asset level.
:::

## Deleting a credential store

To delete a credential store, select **Remove** from the **More Actions** menu of the desired store.

If the selected store is in use, a warning dialog will appear listing the number of robots and assets that will be affected. Click **Delete** to confirm the removal or **Cancel** to abort. Note that you must have at least one credential store active at all times. If only one is present, then the option to delete it does not appear.

:::note
A credential store designated as default cannot be deleted. You must first select a different default store for the credential type.
:::